[Git][security-tracker-team/security-tracker][master] Add commit references for python-django issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c30a06bc by Salvatore Bonaccorso at 2026-11-03T22:54:30+01:00
Add commit references for python-django issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,21 +1,27 @@
 CVE-2026-108147 [Potential memory exhaustion in MultiPartParser via base64-encoded file upload]
 	- python-django 3:5.2.19-1 (bug #1152952)
 	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/4bd1f59a80adafddbd47527c66d92d6a224244d8 (5.2.19)
 CVE-2026-111211 [Potential log injection via unescaped geometry form values]
 	- python-django 3:5.2.19-1 (bug #1152952)
 	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a (5.2.19)
 CVE-2026-111362 [Server-side request forgery via crs member of GeoJSON geometries]
 	- python-django 3:5.2.19-1 (bug #1152952)
 	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/31bef742da017bc71fdce9298c30984aad844102 (5.2.19)
 CVE-2026-113593 [Potential exposure of private data via empty and missing Vary headers]
 	- python-django 3:5.2.19-1 (bug #1152952)
 	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/9007fecd3633cfd90b093ebe106af564347c8aee (5.2.10)
 CVE-2026-113733 [Password hash disclosure to "view only" admin users with custom user models]
 	- python-django <not-affected> (Vulnerable code introduced in Django 6.0)
 	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365 (6.0.10)
 CVE-2026-114582 [Server-side request forgery via SpatialReference string input]
 	- python-django 3:5.2.19-1 (bug #1152952)
 	NOTE: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
+	NOTE: Fixed by: https://github.com/django/django/commit/8bda4d0db15f28828d8db000287562efae5ce063 (5.2.19)
 CVE-2026-XXXX [GHSA-w3p9-g4p2-h3rr: phpseclib unbounded PBKDF iteration count in encrypted key/PFX/CMS parsing enables CPU-exhaustion DoS]
 	- php-phpseclib4 4.0.3-1
 	- php-phpseclib3 3.0.58-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c30a06bcd33a2b0b524b8d3b755a42e25e6bdd44

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c30a06bcd33a2b0b524b8d3b755a42e25e6bdd44
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/d1321398/attachment-0001.htm>